CVE-2026-123207
Received Received - Intake

LibreTV v2.21.1 Server-Side Request Forgery via Unpinned DNS

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123207
EUVD
EUVD-2026-117652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LibreSpark LibreTV 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreTV before v2.21.2 has a server-side request forgery (SSRF) vulnerability due to DNS rebinding. Authenticated users can bypass SSRF protections by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling DNS can return public IPs during validation but switch to internal addresses during connection, reaching loopback services, private hosts, or cloud metadata endpoints via endpoints like /api/source/test or /api/proxy.

Detection Guidance

To detect this vulnerability, monitor network traffic for outbound requests to private or loopback addresses from LibreTV endpoints like /api/source/test, /api/proxy, /api/search, or /api/detail. Check DNS logs for suspicious DNS rebinding attempts where a domain resolves to public IPs during validation but private IPs during connection time.

Impact Analysis

An attacker could use this to make the server send requests to internal systems, exposing sensitive data or services. This includes accessing loopback services, private network hosts, or cloud metadata endpoints like 169.254.169.254. The impact depends on the server's internal network configuration and services.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. Unauthorized network access may result in data breaches, non-compliance with access controls, and failure to protect sensitive information.

Mitigation Strategies

Immediately upgrade LibreTV to version 2.21.2 or later to apply the DNS rebinding protection fix. If upgrading is not possible, restrict access to vulnerable endpoints and implement network-level controls to block outbound requests to private or loopback addresses from the LibreTV server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...